A critical remote code execution bug (CVE-2024-4577) in all versions of PHP on Windows has been patched. The bug also affects all Windows versions of XAMPP.
An attacker pushed two malicious commits to the PHP source code Git server on Sunday, adding a backdoor, which was quickly removed.